This data protection notice informs you about how we handle your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The controller for data processing is CMP Cologne GmbH (hereinafter referred to as „we“ or „us“).
Our data protection information consists of two parts. Part A provides you with general information on data protection at CMP Cologne and explains, among other things, which rights you have and where you can assert them. Part B is dedicated to the various groups of data subjects and explains in detail what data we collect and process about you. We address you in your role as:
a. Visitors to our website,
b. Contact person for customers and interested parties as well as service providers, suppliers and other business partners;
c. Applicants who would like to join our team, as well as
d. Social media visitors who are interested in us.
A. General Information
- Our contact details
If you have any questions or suggestions regarding this information or would like to contact us to assert your rights, please send your enquiry to
CMP Cologne GmbH
Neusser Landstraße 26, 50735 Cologne
Tel: +31 (0)53 482 48 88
E-mail: info@thecompoundcompany.com
- On what basis do we process your data?
The data protection term „personal data“ refers to all information that relates to an identified or identifiable person. We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the BDSG. Data processing by us only takes place on the basis of legal authorisation. We only process personal data with your consent (Art. 6 para. 1 lit. a GDPR), for the fulfilment of a contract to which you are a party or at your request for the implementation of pre-contractual measures (Art. 6 para. 1 lit. b GDPR), for the fulfilment of a legal obligation (Art. 6 para. 1 lit. c GDPR) or if the processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms, which require the protection of personal data, prevail (Art. 6 para. 1 lit. f GDPR).
If you apply for an open position in our company, we will also process your personal data to decide on the establishment of an employment relationship (Section 26 para. 1 sentence 1 BDSG).
- Your rights
You decide on your data! As a data subject, you therefore have the right to assert your data subject rights against us. You have the following rights within the framework of the data protection laws applicable to you:
- In accordance with Art. 15 GDPR and Section 34 BDSG, you have the right to request access as to whether or not we process personal data relating to you and, if so, to what extent.
- You have the right to demand that we rectify your data in accordance with Art. 16 GDPR.
- You have the right to demand that we erase your personal data in accordance with Art. 17 GDPR and Section 35 BDSG.
- You have the right to have the processing of your personal data restricted in accordance with Art. 18 GDPR.
- In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.
- If you have given us separate consent to process your data, you can withdraw this consent at any time in accordance with Art. 7 para. 3 GDPR. Such a withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
- If you believe that the processing of personal data concerning you violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.
In accordance with Art. 21 para. 1 GDPR, you have the right to object to processing based on the legal basis of Art. 6 para. 1 lit. e or f GDPR on grounds relating to your particular situation. If we process personal data about you for the purpose of direct marketing, you can object to this processing in accordance with Art. 21 para. 2 and para. 3 GDPR.
If you exercise your rights in accordance with Art. 15 to 22 GDPR, we will process the personal data transmitted for the purpose of implementing these rights by us and to be able to provide proof of this. We will only process data stored for the purpose of providing and preparing information for this purpose and for the purposes of data protection monitoring and will otherwise restrict processing in accordance with Art. 18 GDPR.
This processing is based on the legal basis of Art. 6 para. 1 lit. c GDPR in conjunction with. Art. 15 to 22 GDPR and § 34 para. 2 BDSG.
- Where do we process your data?
In principle, we process your data on European servers with the highest security standards. In providing our services, we are supported by external service providers to whom we send your data. Some data processing operations may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR is not applicable law. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is required in such a third country. This applies to all transfers to countries in this list: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
If there is no such adequacy decision by the European Commission, personal data will only be transferred to a third country if there are suitable guarantees in accordance with Art. 46 GDPR or if one of the conditions of Art. 49 GDPR is met.
Unless there is an adequacy decision and unless otherwise stated below, we use the EU Standard Contractual Clauses as appropriate safeguards for the transfer of personal data from the scope of the GDPR to third countries. You have the option of obtaining or viewing a copy of these EU Standard Contractual Clause. Please contact us at the address given under Contact.
If you consent to the transfer of personal data to third countries, the transfer takes place on the legal basis of Art. 49 para. 1 lit. a GDPR.
- To whom and why do we transfer your personal data?
In order to provide our services and operate economically as a company, we use various external companies to which we transfer personal data in some cases. If other specific recipients contain personal data for some groups of data subjects, we will inform you about this in Part B.
| Receiver | Reason for disclosure |
|---|---|
| Hosting provider | We do not have our own servers, but commission certified service providers to host our IT services. |
| IT service provider and SaaS provider | We use the services of various service providers who help us as processors to provide you with our services. |
| Advertising and marketing service provider | We want to provide our customers with an attractive product and convince more customers to choose us. To this end, we commission advertising and marketing service providers. |
| Affiliated companies | We are a company of the group of companies „The Compound Company“. Within the group, we procure and provide various services (e.g. IT services). This also involves data processing. |
| Authorities | To comply with legal requirements or to respond to court orders or other similar official requests. |
| Service provider | We may also transfer your personal data to organisations such as postal and delivery services, your bank, tax consultants/auditors or the tax authorities, as well as to service providers for document destruction. |
- How long do we store your data?
Unless otherwise stated in the following information, we only store the data for as long as is necessary to achieve the purpose of processing or to fulfil our contractual or legal obligations. Such statutory retention obligations may arise in particular from commercial or tax law regulations. From the end of the calendar year in which the data was collected, we will retain such personal data contained in our accounting data for ten years and retain personal data contained in commercial letters and contracts for six years. In addition, we will retain data in connection with consents requiring proof and with complaints and claims for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to processing for this purpose.
- How can you contact our data protection officer?
You can reach our data protection officer using the following contact details:
E-Mail: dsb_thecompoundcompany@datenschutzkanzlei.de
Herting Oberbeck Datenschutz GmbH
https://www.datenschutzkanzlei.de
B. Special section – How and why process your data
a. Website visitors
We do not operate our own website. Information about our services can be accessed via the website of the group of companies (https://www.thecompoundcompany.com/). The website is operated by The Compound Company B.V. as a data controller in their own responsibility. This company also decides on the integration of third-party tools and cookies.
Information on data processing when visiting the website can be found here: https://www.thecompoundcompany.com/privacy-statement/.
b. Contact person for customers and interested parties as well as service providers, suppliers and other business partners
| What do we process? | For what purposes do we use the collected data? |
|---|---|
| Data that you provide to us about yourself and the company in which you work, such as your name, e-mail address and telephone number. | – Acquisition of new customers; – Establishment of contracts with the company in which you work; – Fulfilment of the contract with the company in which you work (this includes contract management, billing and communication).Legal basis: Art. 6 para. 1 lit. f) GDPR. Our legitimate interest is to establish new business relationships and to fulfil existing contractual relationships. |
c. Applicants
| What do we process? | For what purposes do we use the collected data? |
|---|---|
| Data that you provide to us in the course of your application or that a recruitment agency transmits to us. This is information about your CV, your previous career and other data that you provide. | – Determining whether employment is possible; – Initiation of an employment relationship.Legal basis: Art. 6 para. 1 lit. b) GDPR – Fulfilment of statutory retention obligations or defence against legal claims.Legal basis: Art. 6 para. 1 lit. c) GDPR – Inclusion in our talent pool to be contacted again later if no employment relationship materialises for the time being. Legal basis: Art. 6 para. 1 lit. a) GDPR. |
If we are unable to offer you employment, we will retain your application submitted by you for up to six months after any rejection for the purpose of answering questions in connection with your application and rejection. This does not apply if statutory provisions prevent deletion, if further storage is necessary for the purpose of providing evidence or if you have expressly consented to longer storage.
d. Social media visitors
| Controller | Data processing | Further information |
|---|---|---|
| Social media provider | When you visit our social media pages (LinkedIn), through which we present our company or individual products from our range, certain information about you is processed. | Privacy Policy of the LinkedIn Ireland Unlimited Company |
| Social-Media-Anbieter und CMP Cologne (Joint Controller) | The social media providers provide us with statistics and insights for our pages in anonymised form, with the help of which we gain knowledge about the types of actions that people take on our site (so-called „page insights“). These page insights are created on the basis of certain information about people who have visited our site. | Joint Controller Agreement of LinkedIn Ireland Unlimited Company
Data subject rights can be asserted against LinkedIn via this contact form. You can contact the data protection officer via this link. We have agreed with LinkedIn that the Irish Data Protection Commission is the lead supervisory authority overseeing processing for Page Insights. You can lodge your complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other supervisory authority. |
| CMP Cologne GmbH | We process information that you have made available to us via our social media page on the respective social media platform. Such information may include the username used, contact details or a message to us. | Communication and answering enquiries, company presentation.
Legal basis: Art. 6 para. 1 lit. f) GDPR. Our legitimate interest is to interact with potential applicants and interested parties for our company and to present ourselves and answer any enquiries. |